fix(kanban): add fail-closed embedded dispatcher quiesce

[dagyrox]

Summary

Adds a provider-supported, fail-closed quiescence boundary for the gateway-embedded Kanban dispatcher so a service handoff can drain the old owner before enabling a standalone dispatcher.

• adds hermes kanban dispatcher-quiesce --pid <MainPID> --timeout <seconds> --json
• identifies the exact embedded owner with per-acquisition generation metadata
• prevents new dispatcher ticks after the quiesce boundary
• drains active asyncio.to_thread(...) work before acknowledging, including under repeated watcher cancellation
• keeps the old gateway watcher quiesced while retaining the singleton lock until gateway shutdown
• returns fixed machine-readable states and nonzero failure exits through installed, module, and repository-local launchers
• keeps the control protocol independent of SQLite initialization, so it remains available with a corrupt/inaccessible board DB
• stores protocol files in a private owner-only POSIX control directory; unsupported Windows control metadata fails closed rather than trusting forgeable mode bits
• does not signal, terminate, pause, resume, or mutate child workers/tasks

Closes #221.

Safety contract

A successful result:

{"ok": true, "state": "quiesced", "owner_pid": 1234, "owner_mode": "embedded"}

means the targeted embedded owner acknowledged quiescence only after its active dispatcher tick drained. Repeated requests are idempotent. not_running, not_owner, timeout, indeterminate, and invalid_request return nonzero and must stop the caller's cutover.

Verification

• scripts/run_tests.sh tests/gateway/test_kanban_dispatcher_quiescence.py tests/hermes_cli/test_kanban_dispatcher_options.py tests/gateway/test_kanban_watchers_mixin.py tests/hermes_cli/test_kanban_core_functionality.py -v --tb=short — 221 passed
• python -m ruff check ... on all changed Python files — passed
• python -m compileall -q ... on changed Python files — passed
• predecessor proof: cancellation/drain regression fails on provider base 83d466e443f8c4e6d1526cebd90c9b0cfceb22cb
• sabotage proof: removing cancellation drain makes the repeated-cancellation regression fail
• live local CLI smoke: initial quiesce and retry both returned quiesced with exit 0 against the exact owner PID, even with an inaccessible HERMES_KANBAN_DB

Provenance

• Acting lane: Talos builder
• Provider issue: fix(security): block path traversal in skill_view file_path parameter #221
• Hermes Kanban: t_c349e5f1
• Run ID: run-20260824-issue-221
• Work packet: /root/.hermes/worktrees/or7-command-center/pending_review/hermes-occ-model-provider-cutover-control.md
• Commit: 29aa227ef5